aa7657a6de9e298353bbaadcd97eecbca5bb97f36e610d36c28c6be858de44ed

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
28-03-2023 15:56

Target

aa7657a6de9e298353bbaadcd97eecbca5bb97f36e610d36c28c6be858de44ed.dll
Size

349KB
MD5

d6459c99e61e894f51180eeceb2cfeb0
SHA1

62f0f170ca4bbcd6db460a47028d4fa19fb931b0
SHA256

aa7657a6de9e298353bbaadcd97eecbca5bb97f36e610d36c28c6be858de44ed
SHA512

feebdac71937e7c98ae72384309710ac0a7bd8af100b8a5a70e854ff83ad746ee3b8c1412e9d1f74eafb45267f54a415c5ef9705710512351733fa97a153025c
SSDEEP

6144:zX1K0hROWQHfYtH4vewREwSBPuuOVN7Oc5jthTq5wzDigK:z1KMEWQHfaYvey6OT7x/1Dig

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

944 1692 WerFault.exe regsvr32.exe

pid	pid_target	process	target process
944	1692	WerFault.exe	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 1692 wrote to memory of 944	1692	regsvr32.exe	WerFault.exe
PID 1692 wrote to memory of 944	1692	regsvr32.exe	WerFault.exe
PID 1692 wrote to memory of 944	1692	regsvr32.exe	WerFault.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa7657a6de9e298353bbaadcd97eecbca5bb97f36e610d36c28c6be858de44ed.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1692 -s 220
2⤵
- Program crash
PID:944